::############# ########### ####### ##### ### ##
::#
::# Copyright (C) 2010 The file Group, LLC
::#
::# This program is free software: you can redistribute it and/or modify 
::# it under the terms of the GNU General Public License as published by
::# the Free Software Foundation, either version 3 of the License, or
::# (at your option) any later version.
::#
::# This program is distributed in the hope that it will be useful,
::# but WITHOUT ANY WARRANTY; without even the implied warranty of
::# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
::# GNU General Public License for more details.
::#
::# You should have received a copy of the GNU General Public License
::# along with this program (See file named COPYING).  If not, see 
::# <http://www.gnu.org/licenses/>.
::# 
::############# ########### ####### ##### ### ##

@echo off
:: Clear variables
set hst_name=
set mac_addr=
set ip_addr=
set file_apnd=
set file_apnd=FIRST
set rnd_num=
set rnd_num=%random%
set rnd_num2=
set rnd_num2=%random%

ipconfig /all | find "Physical Address" > poo_file_phys_addr_%rnd_num%.txt
for /f "tokens=1-2 delims=:" %%i in (poo_file_phys_addr_%rnd_num%.txt) do echo %%j> poo_file_2_%rnd_num%.txt
for /F "tokens=*" %%i in ('more poo_file_2_%rnd_num%.txt') do set mac_addr=%%i
for /f %%i in ("%mac_addr%") do set mac_addr=%%i

:: Establish directory. If it is there then append random number to front of output files
:: allows us to understand if this is a second or third run.
mkdir out\%mac_addr%
if errorlevel 1 set file_apnd=%rnd_num%

:: Establish the log file
>> out\%mac_addr%\log_%file_apnd%.txt echo **** Start log ****
>> out\%mac_addr%\log_%file_apnd%.txt echo %date% %time%

:: Write client mac addr
>> out\%mac_addr%\host_info_%file_apnd%.txt echo mac,%mac_addr%
>> out\%mac_addr%\log_%file_apnd%.txt echo Wrote Mac to host_info_%file_apnd%.txt

:: Get and write client hostnamet
for /F "tokens=*" %%i in ('hostname') do set hst_name=%%i
>> out\%mac_addr%\host_info_%file_apnd%.txt echo hostname,%hst_name%
>> out\%mac_addr%\log_%file_apnd%.txt echo Wrote hostname to host_info_%file_apnd%.txt

:: Get and write client IP Addr
ipconfig | find "IP Address" > poo_file_ip_addr_%rnd_num%.txt
for /f "tokens=1-2 delims=:" %%i in (poo_file_ip_addr_%rnd_num%.txt) do echo %%j> poo_file_3_%rnd_num%.txt
for /F "tokens=*" %%i in ('more poo_file_3_%rnd_num%.txt') do set ip_addr=%%i
for /f %%i in ("%ip_addr%") do set ip_addr=%%i
>> out\%mac_addr%\host_info_%file_apnd%.txt echo ip,%ip_addr%
>> out\%mac_addr%\log_%file_apnd%.txt echo Wrote ip addr to host_info_%file_apnd%.txt

:: Write version information
ver >> out\%mac_addr%\host_info_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Wrote OS version info to host_info_%file_apnd%.txt

:: Create local tmp dir
::mkdir c:\file_%rnd_num2%
::if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Could not create local tmp dir ***

:: Create local clam tmp dir
:: mkdir c:\file_%rnd_num2%\clam_tmp
:: if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Could not create local clam tmp dir ***

:: Dumpsec c dir report
:: SystemTools\DUMPSEC.exe /rpt=dir=c:\ /outfile=out\%mac_addr%\dumpsec_c_dir_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=dir=c:\ /outfile=out\%mac_addr%\dumpsec_c_dir_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec c dir report had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_c_dir_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec c dir report done %date% %time%

:: Dumpsec HKEY_USERS permissions
:: SystemTools\DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=out\%mac_addr%\dumpsec_hkey_users_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=out\%mac_addr%\dumpsec_hkey_users_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec hkey_users report had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_hkey_users_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec hkey_users report done %date% %time%

:: Dumpsec HKEY_LOCAL_MACHINE permissions
:: SystemTools\DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=out\%mac_addr%\dumpsec_hkey_local_machine_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=out\%mac_addr%\dumpsec_hkey_local_machine_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec hkey_local_machine report had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_hkey_local_machine_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec hkey_local_machine report done %date% %time%

:: Dumpsec all share dirs
:: SystemTools\DUMPSEC.exe /rpt=allsharedirs /outfile=out\%mac_addr%\dumpsec_allshares_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=allsharedirs /outfile=out\%mac_addr%\dumpsec_allshares_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec allsharesdirs had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_allshares_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec allsharesdirs done %date% %time%

:: Dumpsec printers
:: SystemTools\DUMPSEC.exe /rpt=printers /outfile=out\%mac_addr%\dumpsec_printers_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=printers /outfile=out\%mac_addr%\dumpsec_printers_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec printers had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_printers_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec printers done %date% %time%

:: Dumpsec users
:: SystemTools\DUMPSEC.exe /rpt=users /outfile=out\%mac_addr%\dumpsec_users_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=users /outfile=out\%mac_addr%\dumpsec_users_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec users had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_users_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec users done %date% %time%

:: Dumpsec groups
:: SystemTools\DUMPSEC.exe /rpt=groups /outfile=out\%mac_addr%\dumpsec_groups_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=groups /outfile=out\%mac_addr%\dumpsec_groups_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec groups had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_groups_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec groups done %date% %time%

:: Dumpsec policy
:: SystemTools\DUMPSEC.exe /rpt=Policy /outfile=out\%mac_addr%\dumpsec_policy_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=Policy /outfile=out\%mac_addr%\dumpsec_policy_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec policy had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_policy_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec policy done %date% %time%

:: Dumpsec rights
:: SystemTools\DUMPSEC.exe /rpt=rights /outfile=out\%mac_addr%\dumpsec_rights_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=rights /outfile=out\%mac_addr%\dumpsec_rights_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec rights had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_rights_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec rights done %date% %time%

:: Dumpsec services
:: SystemTools\DUMPSEC.exe /rpt=services /outfile=out\%mac_addr%\dumpsec_services_%file_apnd%.dcl
exec\SystemTools\DUMPSEC.exe /rpt=services /outfile=out\%mac_addr%\dumpsec_services_%file_apnd%.txt /saveas=csv
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Dumpsec services had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\dumpsec_services_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo Dumpsec services done %date% %time%

:: netstat -an
netstat -an > out\%mac_addr%\netstat_an_%file_apnd%.txt
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** netstat_an had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\netstat_an_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo netstat_an done %date% %time%

:: netstat -anr
netstat -anr > out\%mac_addr%\netstat_anr_%file_apnd%.txt
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** netstat_anr had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\netstat_anr_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo netstat_anr done %date% %time%

:: tcpvcon -a -c
exec\TcpView\tcpvcon -a -c > out\%mac_addr%\tcpvcon_ac_%file_apnd%.txt
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** tcpvcon_ac had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\tcpvcon_ac_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo tcpvcon_ac done %date% %time%

:: mbsa
exec\mbsa\mbsacli /hf -o tab -f ..\..\out\%mac_addr%\mbsa_%file_apnd%.txt -v -nvc -history 3
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** mbsa had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\mbsa_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo mbsa done %date% %time%

:: pwdump
exec\pwdump6\PwDumpRelease\PwDump -u USERNAME -o out\%mac_addr%\pwdump_%file_apnd%.txt %hst_name%
if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** pwdump had error ***
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\pwdump_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo pwdump done %date% %time%

:: md5deep
:: exec\md5deep\md5deep -s -r c:\* > out\%mac_addr%\md5deep_%file_apnd%.txt
:: if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** md5deep had error ***
:: type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\md5deep_%file_apnd%.txt
:: >> out\%mac_addr%\log_%file_apnd%.txt echo md5deep done %date% %time%

:: Clamscan
:: ClamWinPortable\App\clamwin\bin\clamscan -d ClamWinPortable/Data/db --no-archive --exclude=".mp3" --exclude=".jpg" --exclude=".wma" -i -r -l out\%mac_addr%\clamscan_%file_apnd%.txt c:\
:: with temp dir ClamWinPortable\App\clamwin\bin\clamscan -d ClamWinPortable/Data/db --no-archive --exclude=".mp3" --exclude=".jpg" --exclude=".wma" -i -r -l out\%mac_addr%\clamscan_%file_apnd%.txt --tempdir=c:\file_%rnd_num%\clam_tmp c:\
:: if errorlevel 1 >> out\%mac_addr%\log_%file_apnd%.txt echo *** Clamscan had error ***
:: type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\clamscan_%file_apnd%.txt
:: >> out\%mac_addr%\log_%file_apnd%.txt echo Clamscan done %date% %time%

:: arp -a
arp -a > out\%mac_addr%\arp_a_%file_apnd%.txt
type out\%mac_addr%\host_info_%file_apnd%.txt >> out\%mac_addr%\arp_a_%file_apnd%.txt
>> out\%mac_addr%\log_%file_apnd%.txt echo arp -a done %date% %time%

:: clean your poo!
del *%rnd_num%*
>> out\%mac_addr%\log_%file_apnd%.txt echo Poo has been cleaned! :-)

:: All done
>> out\%mac_addr%\log_%file_apnd%.txt echo %date% %time%
>> out\%mac_addr%\log_%file_apnd%.txt echo **** End log ****

:: tar up everything
::nxbin\tar -cf done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.tar out\%mac_addr%\*

:: gzip the file
::nxbin\gzip done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.tar

:: zip the file
exec\nxbin\zip -q done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.zip out\%mac_addr%\*

:: encrypt file
exec\GnuPG\gpg --homedir .\GnuPG\ --batch --always-trust --output done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.zip.gpg -e -r filegroup@file.com done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.zip

:: wipe old data
exec\SDelete\sdelete -p 1 out\%mac_addr%\*
rmdir out\%mac_addr%
exec\SDelete\sdelete -p 1 done\win_host_%mac_addr%_%file_apnd%_%rnd_num2%.zip
:: SDelete\sdelete -p 2 c:\file_%rnd_num2%\clam_tmp\*
:: rmdir c:\file_%rnd_num2%\clam_tmp
:: SDelete\sdelete -p 2 c:\file_%rnd_num2%\*
:: rmdir c:\file_%rnd_num2%

:: reboot the system
:: shutdown -r -f -t 1
